Using E-Stops in Lockout Procedures

Con­trol of haz­ard­ous energy is one of the key ways that main­ten­ance and ser­vice work­ers are pro­tec­ted while main­tain­ing indus­tri­al equip­ment. Not so long ago we only thought about ‘Lock­out’ or ‘Lockout/Tagout’ pro­ced­ures, but there is much more to pro­tect­ing these work­ers than ‘just’ lock­ing out energy sources. Inev­it­ably con­di­tions come up where safe­guards may need to be removed or tem­por­ar­ily bypassed in order to dia­gnose prob­lems or to make crit­ic­al but infre­quent adjust­ments to the equip­ment, and this is where Haz­ard­ous Energy Con­trol Pro­ced­ures, or HECP, come in.

One of the ques­tions I often get when help­ing cli­ents with devel­op­ing HECPs for their equip­ment is, “Can we use the emer­gency stop cir­cuit for lock­out?” As usu­al, there is a short answer and a long answer to that simple ques­tion!

The Short Answer

The short answer to this ques­tion is NO. Lock­out requires that sources of haz­ard­ous energy be phys­ic­ally isol­ated or blocked. Con­trol sys­tems may be able to meet parts, but not all of this require­ment. Read on if you’d like to know why.

The Long Answer

Lockout

Lock­out pro­ced­ures are now grouped with oth­er adjust­ment, dia­gnost­ic and test pro­ced­ures into what are called Haz­ard­ous Energy Con­trol Pro­ced­ures or HECP. In the USA, OSHA pub­lishes a lock­out stand­ard in 29 CFR 1910.147, and ANSI pub­lishes ANSIZ244.1.

In Canada, we didn’t have a stand­ard for HECP until 2005 when CSAZ460 was pub­lished, although all the Provinces and Ter­rit­or­ies have some lan­guage in their legis­la­tion that at least alludes to the need for con­trol of haz­ard­ous energy. In the Province of Ontario where I live, this require­ment shows up in Ontario Reg­u­la­tion 851, Sec­tions 42, 75 and 76.

In the EU, con­trol of haz­ard­ous energy is dealt with in ISO 14118:2000, Safety of machinery — Pre­ven­tion of unex­pec­ted start-up.

If you have a look at the sec­tions of the Ontario reg­u­la­tions, they don’t tell you how to per­form lock­out, and they make little men­tion of what to do with live work for troubleshoot­ing pur­poses. The USOSHA reg­u­la­tions read more like a stand­ard, but because they are in legis­la­tion they are pre­script­ive. You MUST meet this min­im­um require­ment, and you may exceed it.

Let’s look at how “lock­out” is defined in the stand­ards.

Canada (Ontario)

USA (OSHA)

European Uni­on

Lock­out — place­ment of a lock or tag on an energy-isol­at­ing device in accord­ance with an estab­lished pro­ced­ure, thereby indic­at­ing that the energy-isol­at­ing device is not to be oper­ated until remov­al of the lock or tag in accord­ance with an estab­lished pro­ced­ure.

CSAZ460, 2005

Lock­out. The place­ment of a lock­out device on an energy isol­at­ing device, in accord­ance with an estab­lished pro­ced­ure, ensur­ing that the energy isol­at­ing device and the equip­ment being con­trolled can­not be oper­ated until the lock­out device is removed.

Tagout. The place­ment of a tagout device on an energy isol­at­ing device, in accord­ance with an estab­lished pro­ced­ure, to indic­ate that the energy isol­at­ing device and the equip­ment being con­trolled may not be oper­ated until the tagout device is removed.

29 CFR 1910.147

2.14 lockout/tagout: The place­ment of a lock/tag on the energy isol­at­ing device in accord­ance with an estab­lished pro­ced­ure, indic­at­ing that the energy isol­at­ing device shall not be oper­ated until remov­al of the lock/tag in accord­ance with an estab­lished pro­ced­ure. (The term “lockout/tagout” allows the use of a lock­out device, a tagout device, or a com­bin­a­tion of both.)

ANSIZ244.1 – 2003

3.3 isol­a­tion and energy dis­sip­a­tion

pro­ced­ure which con­sists of all of the four fol­low­ing actions:

a) isol­at­ing (dis­con­nect­ing, sep­ar­at­ing) the machine (or defined parts of the machine) from all power sup­plies;

b) lock­ing (or oth­er­wise secur­ing), if neces­sary (for instance in large machines or in install­a­tions), all the isol­at­ing units in the “isol­ated” pos­i­tion;

c) dis­sip­at­ing or restrain­ing [con­tain­ing] any stored energy which may give rise to a haz­ard.

NOTE Energy con­sidered in c) above may be stored in e.g.:

mech­an­ic­al parts con­tinu­ing to move through iner­tia;

mech­an­ic­al parts liable to move by grav­ity;

capa­cit­ors, accu­mu­lat­ors;

pres­sur­ized flu­ids;

springs.

d) veri­fy­ing by using a safe work­ing pro­ced­ure that the actions taken accord­ing to a), b) and c) above have pro­duced the desired effect.

ISO 14118 – 2000

As you can see, the defin­i­tions are fairly sim­il­ar, although slightly dif­fer­ent terms may be used. The ISO stand­ard actu­ally provides the best guid­ance over­all in my opin­ion. Note that these excerpts are all taken from the defin­i­tions sec­tions of the rel­ev­ant doc­u­ments.

One of the big dif­fer­ences between the US and Canada is the idea of ‘tagout’ (pro­nounced TAG-out for those not famil­i­ar with the term). Tagout is identic­al to lock­out with the excep­tion of the device that is attached to the energy isol­at­ing device. Under cer­tain cir­cum­stances, the US per­mits the use of a tag without a lock to secure the energy isol­a­tion device. This is not per­mit­ted in Canada under any cir­cum­stance, and the term ‘tagout’ is not offi­cially recog­nized. In Canada, the term is often taken to mean the addi­tion of a tag to the lock­ing device, a man­dat­ory part of the pro­ced­ure.

Use of Controls for Energy Isolation

This is where the ‘rub­ber meets the road’ – how is the source of haz­ard­ous energy isol­ated effect­ively? To under­stand the require­ments, let’s look at the defin­i­tion of an Energy Isol­at­ing Device.

Canada

USA

EU

Energy-isol­at­ing device — a mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a manu­ally oper­ated elec­tric­al cir­cuit break­er; a dis­con­nect switch; a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors; a line valve; a block; and oth­er devices used to block or isol­ate energy (push-but­ton select­or switches and oth­er con­trol-type devices are not energy-isol­at­ing devices).

CSAZ460, 2005

Note – Bold added for emphas­is – DN

Energy isol­at­ing device. A mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: A manu­ally oper­ated elec­tric­al cir­cuit break­er; a dis­con­nect switch; a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors, and, in addi­tion, no pole can be oper­ated inde­pend­ently; a line valve; a block; and any sim­il­ar device used to block or isol­ate energy. Push but­tons, select­or switches and oth­er con­trol cir­cuit type devices are not energy isol­at­ing devices.

Note – Bold added for emphas­is – DN

Tagout device. A prom­in­ent warn­ing device, such as a tag and a means of attach­ment, which can be securely fastened to an energy isol­at­ing device in accord­ance with an estab­lished pro­ced­ure, to indic­ate that the energy isol­at­ing device and the equip­ment being con­trolled may not be oper­ated until the tagout device is removed.

29 CFR 1910.147

2.8 energy isol­at­ing device: A mech­an­ic­al device that phys­ic­ally pre­vents the trans­mis­sion or release of energy, includ­ing but not lim­ited to the fol­low­ing: a manu­ally oper­ated elec­tric­al cir­cuit break­er, a dis­con­nect switch, a manu­ally oper­ated switch by which the con­duct­ors of a cir­cuit can be dis­con­nec­ted from all ungroun­ded sup­ply con­duct­ors and, in addi­tion, no pole can be oper­ated inde­pend­ently; a line valve; a block; and any sim­il­ar device used to block or isol­ate energy.

2.20.1 tagout device: A prom­in­ent warn­ing means such as a tag and a means of attach­ment, which can be securely fastened to an energy isol­at­ing device to indic­ate that the energy isol­at­ing device and the equip­ment being con­trolled may not be oper­ated until the tagout device is removed.

ANSIZ244.1 – 2003

4.1 Isol­a­tion and energy dis­sip­a­tion

Machines shall be provided with means inten­ded for isol­a­tion and energy dis­sip­a­tion (see clause 5), espe­cially with a view to major main­ten­ance, work on power cir­cuits and decom­mis­sion­ing in accord­ance with the essen­tial safety require­ment expressed in ISO/TR 12100 – 2:1992, annex A, 1.6.3.

NOTE 2 Plug and sock­et sys­tems (for elec­tric­al sup­plies), or their pneu­mat­ic, hydraul­ic or mech­an­ic­al equi­val­ents, are examples of isol­at­ing devices with which it is pos­sible to achieve a vis­ible and reli­able dis­con­tinu­ity in the power sup­ply cir­cuits.

NOTE 3 For hydraul­ic and pneu­mat­ic equip­ment, see also EN 982:1996, 5.1.6 and EN 983:1996, 5.1.6.

ISO 14118 – 2000

BRADY Small Plug Lock­out Device

As you can see from the above defin­i­tions, all the jur­is­dic­tions require that devices used for energy isol­a­tion are reli­able, manu­ally oper­able, mech­an­ic­al devices. While elec­tric­al con­trol sys­tems that meet high levels of design reli­ab­il­ity may meet the reli­ab­il­ity require­ments, they do not meet the require­ments for phys­ic­al, mech­an­ic­al dis­con­nec­tion of the source of haz­ard­ous energy. Oper­at­or devices are spe­cific­ally excluded from this use in Canada and the USA. Note that plug and sock­et com­bin­a­tions are per­mit­ted in all jur­is­dic­tions. Lock­out devices such as Brady 65675 Large Plug Lock­out Device, like the Brady Small Plug Lock­out Device shown here and sim­il­ar devices, can be used for this pur­pose. With some plugs, it is pos­sible to put a small lock through a hole in one of the blades or pins. In some jur­is­dic­tions, even the simple act of put­ting the plug in your back pock­et while con­duct­ing the work is suf­fi­cient.

But­ton Lock­ing Device

In addi­tion, the energy isol­a­tion device is required to be able to be locked in the off, isol­ated, or blocked pos­i­tion. There are emer­gency stop but­ton oper­at­ors that can be pur­chased with an integ­rated lock cyl­in­der, and there are some con­trol oper­at­or accessor­ies avail­able that will allow con­trol push­but­tons and select­or switches to be locked in one pos­i­tion or anoth­er, but these do not meet the require­ments of the above stand­ards. They can be used in addi­tion to an energy isol­a­tion device as part of the pro­ced­ure, but not on their own as the sole means of pre­vent­ing unex­pec­ted start-up.

Conclusions

Each machine or piece of equip­ment is required to have a HECP that is spe­cif­ic to that piece of equip­ment. ‘Glob­al’ HECP’s are sel­dom use­ful except as a tem­plate doc­u­ment. Devel­op­ment of HECPs takes some care­ful thought and a thor­ough under­stand­ing of the kinds of work that will need to be done to main­tain and ser­vice the machinery. Indi­vidu­al jur­is­dic­tions have some dif­fer­ences in the details of their reg­u­la­tions, but ulti­mately the require­ments come down to the same thing: Pro­tect­ing work­ers.

Con­trol sys­tem devices such as stop but­tons and emer­gency stop devices are not accep­ted as energy isol­at­ing devices and can­not be used for this pur­pose, although they may be used as part of the HECP shut­down pro­ced­ure lead­ing up to the phys­ic­al isol­a­tion of the haz­ard­ous energy sources.

Excel­lent stand­ards exist that cov­er the devel­op­ment of these pro­ced­ures and should be ref­er­enced as spe­cif­ic HECP are developed.

You may copy this con­tent, cre­ate deriv­at­ive work from it, and re-pub­lish it for non-com­mer­cial pur­poses, provided you include an overt attri­bu­tion to the author(s) and the re-pub­lic­a­tion must itself be under the terms of this license or sim­il­ar.

4 thoughts on “Using E-Stops in Lockout Procedures”

Great com­par­is­on and explan­a­tion! You are quite right that pad­lock­ing the estop is NOT a means of energy isol­a­tion. Instead lock­ing the estop is simply a means of ensur­ing that the estop is not reset, and if all is work­ing as it should and elec­tri­city is the ONLY source of energy, it means that a reset and re-ini­ti­ation of oper­a­tion would not hap­pen. How­ever there is still elec­tric­al energy avail­able, since the lock is not an isol­a­tion device.

In addi­tion, every­one needs to remem­ber that energy isol­a­tion (and lock-out) is NOT just about elec­tric­al energy. Usu­ally there are mul­tiple sources of energy.

Roberta,
Abso­lutely right. Lock­out requires energy isol­a­tion using a device inten­ded for the pur­pose. Con­trol cir­cuits can­not provide this func­tion­al­ity. Each energy source requires a means to reli­ably shut-off and isol­ate it from the machinery, or in the case of sources like grav­ity which can­not be shut-off, their effect must be reli­ably blocked.